fix(sec): restrict node to address CVE-2026-111497

Closed
RU
8d ago
+3-3

Summary by cubic

Restricts supported Node.js versions to patched releases to address CVE-2026-111497.

  • package.json now allows only Node 22.23.4+, 24.22.1+, and 26.12.1+ within their major lines; Node 23 and 25 are no longer supported.
  • CI release workflow now sets up Node 22.23.4 instead of 22.22.2.
  • Developers and CI on older versions will need to upgrade.

Summary by CodeRabbit

  • Compatibility
    • Supported Node.js versions are now limited to >=22.23.4 <23, >=24.22.1 <25, and >=26.12.1 <27. Projects using versions outside these ranges may need to switch to a supported release to continue using the package. Check your project’s Node.js version against these ranges before upgrading or installing the package.